Legality only matters when the law is enforced. That's basically never been the case when it comes to privacy or corporation-against-consumer fraud.